{"schema":"threatline.record/2","record":{"id":"CVE-2026-105747","aliases":["GHSA-3cr3-8m4c-fpxw","PYSEC-2026-4194","PYSEC-2026-4209"],"summary":"Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)","details":"### Summary\n\nWhen docling detects the input format of a gzip-compressed tar archive (METS-GBS), and later when the METS-GBS backend opens it, it calls `tarfile.TarFile.getmembers()`. That builds the full member list in memory before the `max_member_count` limit is checked. A small archive with a very large number of empty members therefore makes docling allocate memory in proportion to the member count, and the limit has no effect.\n\n### Details\n\n`docling/datamodel/document.py` (format detection) and `docling/backend/mets_gbs_backend.py` both iterate `tar.getmembers()` and count members inside the loop. `getmembers()` reads every header up front.\n\nMeasured on Python 3.12: an archive of 1,000,000 empty members compresses to about 6.2 MB and makes `getmembers()` hold about 408 MB (about 66 times the input size). Format detection runs for any `application/gzip` input before `allowed_formats` is applied, so the allocation happens even when METS-GBS is not an allowed format.\n\nThis check was introduced by the fix for CVE-2026-44018 (GHSA-r3xg-rg9j-67fv) in 2.91.0. The eager enumeration it relies on has been there since METS-GBS detection was added in 2.45.0.\n\n### Impact\n\nMemory exhaustion of the converting process, proportional to the size of the input archive. Confidentiality and integrity are not affected.\n\n### Patches\n\nFixed in docling 2.131.0 by [#4412](https://github.com/docling-project/docling/pull/4412). Format detection and the METS-GBS backend now read archive members one at a time and stop as soon as `max_member_count` is exceeded, including when looking up page files.\n\n### Workarounds\n\nUpgrade to 2.131.0. For older versions:\n\nReject gzip or tar inputs before they reach docling when METS-GBS support is not needed, and run conversions of untrusted input with memory limits.","categories":["Libraries & packages"],"product":"docling","vendor":"docling-project","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3cr3-8m4c-fpxw","source_modified_at":"2026-10-06T13:43:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"docling"},"range":">= 2.45.0, < 2.131.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3cr3-8m4c-fpxw","source_modified_at":"2026-10-06T13:43:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"docling-slim"},"range":">= 2.92.0, < 2.131.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105747","source_modified_at":"2026-10-06T14:48:33.056Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"docling","vendor":"docling-project","versions":[{"version":">= 2.45.0, < 2.131.0","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105747","source_modified_at":"2026-10-06T14:48:33.056Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"docling-slim","vendor":"docling-project","versions":[{"version":">= 2.45.0, < 2.131.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3cr3-8m4c-fpxw","source_modified_at":"2026-10-15T14:56:00.401934996Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"docling","purl":"pkg:pypi/docling"},"ranges":[{"events":[{"introduced":"2.45.0"},{"fixed":"2.131.0"}],"type":"ECOSYSTEM"}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.118.1","2.119.0","2.120.1","2.120.2","2.120.3","2.121.0","2.122.0","2.123.0","2.123.1","2.124.0","2.125.0","2.126.0","2.127.0","2.128.0","2.129.0","2.130.0","2.45.0","2.46.0","2.47.0","2.47.1","2.48.0","2.49.0","2.50.0","2.51.0","2.52.0","2.53.0","2.54.0","2.55.0","2.55.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3cr3-8m4c-fpxw","source_modified_at":"2026-10-15T14:56:00.401934996Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"docling-slim","purl":"pkg:pypi/docling-slim"},"ranges":[{"events":[{"introduced":"2.92.0"},{"fixed":"2.131.0"}],"type":"ECOSYSTEM"}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.118.1","2.119.0","2.120.1","2.120.2","2.120.3","2.121.0","2.122.0","2.123.0","2.123.1","2.124.0","2.125.0","2.126.0","2.127.0","2.128.0","2.129.0","2.130.0","2.92.0","2.93.0","2.94.0","2.95.0","2.96.0","2.96.1","2.97.0","2.98.0","2.99.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3cr3-8m4c-fpxw","source_modified_at":"2026-10-06T13:43:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"docling"},"version":"2.131.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-3cr3-8m4c-fpxw","source_modified_at":"2026-10-06T13:43:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"docling-slim"},"version":"2.131.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3cr3-8m4c-fpxw","source_modified_at":"2026-10-15T14:56:00.401934996Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"docling","purl":"pkg:pypi/docling"},"version":"2.131.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-3cr3-8m4c-fpxw","source_modified_at":"2026-10-15T14:56:00.401934996Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"docling-slim","purl":"pkg:pypi/docling-slim"},"version":"2.131.0"}],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0023,"percentile":0.13099,"score_date":"2026-10-23"},"published_at":"2026-10-05T21:32:34.438Z","modified_at":"2026-10-15T14:56:00.401934996Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-3cr3-8m4c-fpxw","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T13:43:20Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105747","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T14:48:33.056Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-3cr3-8m4c-fpxw","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T14:56:00.401934996Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105747","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/docling-project/docling/security/advisories/GHSA-3cr3-8m4c-fpxw","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105747","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/docling-project/docling/pull/4412","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/docling-project/docling/commit/ebae65cd71c37c88b36185b406a449b92d8f7ffa","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/docling-project/docling/releases/tag/v2.131.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-3cr3-8m4c-fpxw","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T14:34:13.770203Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:56:00.401934996Z","content_hash":"497fbb83ed6cc33008e0ff514db97af73f288d12066fce0d7b2e023416893f44"}}